trisulrp 2.2.8 → 3.1.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +2 -2
- data/Rakefile +3 -3
- data/VERSION +1 -1
- data/lib/trisulrp.rb +0 -2
- data/lib/trisulrp/protocol.rb +205 -121
- data/lib/trisulrp/trp.pb.rb +753 -775
- data/lib/trisulrp/trp.proto +688 -494
- data/trisulrp.gemspec +12 -13
- metadata +5 -6
- data/lib/trisulrp/utils.rb +0 -215
data/trisulrp.gemspec
CHANGED
@@ -1,17 +1,17 @@
|
|
1
|
-
# Generated by
|
1
|
+
# Generated by juwelier
|
2
2
|
# DO NOT EDIT THIS FILE DIRECTLY
|
3
|
-
# Instead, edit
|
3
|
+
# Instead, edit Juwelier::Tasks in Rakefile, and run 'rake gemspec'
|
4
4
|
# -*- encoding: utf-8 -*-
|
5
|
-
# stub: trisulrp
|
5
|
+
# stub: trisulrp 3.1.1 ruby lib
|
6
6
|
|
7
7
|
Gem::Specification.new do |s|
|
8
8
|
s.name = "trisulrp"
|
9
|
-
s.version = "
|
9
|
+
s.version = "3.1.1"
|
10
10
|
|
11
11
|
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
12
12
|
s.require_paths = ["lib"]
|
13
13
|
s.authors = ["vivek"]
|
14
|
-
s.date = "
|
14
|
+
s.date = "2016-08-02"
|
15
15
|
s.description = "This gem deals about the trisul remote protocol"
|
16
16
|
s.email = "vivek_rajagopal@yahoo.com"
|
17
17
|
s.extra_rdoc_files = [
|
@@ -32,7 +32,6 @@ Gem::Specification.new do |s|
|
|
32
32
|
"lib/trisulrp/protocol.rb",
|
33
33
|
"lib/trisulrp/trp.pb.rb",
|
34
34
|
"lib/trisulrp/trp.proto",
|
35
|
-
"lib/trisulrp/utils.rb",
|
36
35
|
"test/Demo_Client.crt",
|
37
36
|
"test/Demo_Client.key",
|
38
37
|
"test/cginfo.rb",
|
@@ -50,30 +49,30 @@ Gem::Specification.new do |s|
|
|
50
49
|
]
|
51
50
|
s.homepage = "http://github.com/vivekrajan/trisulrp"
|
52
51
|
s.licenses = ["MIT"]
|
53
|
-
s.rubygems_version = "2.
|
52
|
+
s.rubygems_version = "2.5.1"
|
54
53
|
s.summary = "trisul trp"
|
55
54
|
|
56
55
|
if s.respond_to? :specification_version then
|
57
56
|
s.specification_version = 4
|
58
57
|
|
59
58
|
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
|
60
|
-
s.add_runtime_dependency(%q<
|
59
|
+
s.add_runtime_dependency(%q<protobuf>, [">= 0"])
|
61
60
|
s.add_development_dependency(%q<shoulda>, [">= 0"])
|
62
61
|
s.add_development_dependency(%q<bundler>, [">= 0"])
|
63
|
-
s.add_development_dependency(%q<
|
62
|
+
s.add_development_dependency(%q<juwelier>, [">= 0"])
|
64
63
|
s.add_development_dependency(%q<simplecov>, [">= 0"])
|
65
64
|
else
|
66
|
-
s.add_dependency(%q<
|
65
|
+
s.add_dependency(%q<protobuf>, [">= 0"])
|
67
66
|
s.add_dependency(%q<shoulda>, [">= 0"])
|
68
67
|
s.add_dependency(%q<bundler>, [">= 0"])
|
69
|
-
s.add_dependency(%q<
|
68
|
+
s.add_dependency(%q<juwelier>, [">= 0"])
|
70
69
|
s.add_dependency(%q<simplecov>, [">= 0"])
|
71
70
|
end
|
72
71
|
else
|
73
|
-
s.add_dependency(%q<
|
72
|
+
s.add_dependency(%q<protobuf>, [">= 0"])
|
74
73
|
s.add_dependency(%q<shoulda>, [">= 0"])
|
75
74
|
s.add_dependency(%q<bundler>, [">= 0"])
|
76
|
-
s.add_dependency(%q<
|
75
|
+
s.add_dependency(%q<juwelier>, [">= 0"])
|
77
76
|
s.add_dependency(%q<simplecov>, [">= 0"])
|
78
77
|
end
|
79
78
|
end
|
metadata
CHANGED
@@ -1,17 +1,17 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: trisulrp
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 3.1.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- vivek
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2016-08-02 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
|
-
name:
|
14
|
+
name: protobuf
|
15
15
|
requirement: !ruby/object:Gem::Requirement
|
16
16
|
requirements:
|
17
17
|
- - ">="
|
@@ -53,7 +53,7 @@ dependencies:
|
|
53
53
|
- !ruby/object:Gem::Version
|
54
54
|
version: '0'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
|
-
name:
|
56
|
+
name: juwelier
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
58
58
|
requirements:
|
59
59
|
- - ">="
|
@@ -101,7 +101,6 @@ files:
|
|
101
101
|
- lib/trisulrp/protocol.rb
|
102
102
|
- lib/trisulrp/trp.pb.rb
|
103
103
|
- lib/trisulrp/trp.proto
|
104
|
-
- lib/trisulrp/utils.rb
|
105
104
|
- test/Demo_Client.crt
|
106
105
|
- test/Demo_Client.key
|
107
106
|
- test/cginfo.rb
|
@@ -136,7 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
136
135
|
version: '0'
|
137
136
|
requirements: []
|
138
137
|
rubyforge_project:
|
139
|
-
rubygems_version: 2.
|
138
|
+
rubygems_version: 2.5.1
|
140
139
|
signing_key:
|
141
140
|
specification_version: 4
|
142
141
|
summary: trisul trp
|
data/lib/trisulrp/utils.rb
DELETED
@@ -1,215 +0,0 @@
|
|
1
|
-
# = TrisulRP utility methods
|
2
|
-
#
|
3
|
-
# == Contains utility to print objects like flows, alerts
|
4
|
-
# and to resolve keys etc
|
5
|
-
#
|
6
|
-
|
7
|
-
# ==== TrisulRP::Utils
|
8
|
-
#
|
9
|
-
# Utility methods to help with
|
10
|
-
# * retrieving and printing objects
|
11
|
-
# * prints sessions / alerts if given an array of IDs
|
12
|
-
# * helper to resolve a key
|
13
|
-
#
|
14
|
-
#
|
15
|
-
module TrisulRP::Utils
|
16
|
-
|
17
|
-
# Print session (flow) details
|
18
|
-
#
|
19
|
-
# [conn] active TRP connection opened earlier
|
20
|
-
# [sessions] an array of SessionIDs or
|
21
|
-
# an array of slice:sid strings
|
22
|
-
#
|
23
|
-
# ==== Returns
|
24
|
-
# ==== Yields
|
25
|
-
# Nothing
|
26
|
-
#
|
27
|
-
# Prints details about the list of sessions (flows) passed
|
28
|
-
#
|
29
|
-
# ==== On error
|
30
|
-
def print_session_ids(conn,sessions)
|
31
|
-
all_sids = sessions.collect{ |ai| TRP::SessionID.new(
|
32
|
-
:slice_id => ai.slice_id,
|
33
|
-
:session_id => ai.session_id ) }
|
34
|
-
|
35
|
-
follow_up = TrisulRP::Protocol.mk_request(TRP::Message::Command::SESSION_ITEM_REQUEST,
|
36
|
-
:session_ids => all_sids)
|
37
|
-
|
38
|
-
TrisulRP::Protocol.get_response(conn,follow_up) do |resp|
|
39
|
-
resp.items.each do |item|
|
40
|
-
print_session_details(item)
|
41
|
-
end
|
42
|
-
end
|
43
|
-
end
|
44
|
-
|
45
|
-
|
46
|
-
# Print a SessionDetails object
|
47
|
-
#
|
48
|
-
# Use this to output session to screen
|
49
|
-
#
|
50
|
-
# [sess] a single SessionDetails object
|
51
|
-
#
|
52
|
-
# ==== Returns
|
53
|
-
# ==== Yields
|
54
|
-
# Nothing
|
55
|
-
#
|
56
|
-
# Pretty prints a single line session details
|
57
|
-
#
|
58
|
-
# ==== On error
|
59
|
-
def print_session_details(sess)
|
60
|
-
print "#{sess.session_id.slice_id}:#{sess.session_id.session_id} ".ljust(12)
|
61
|
-
print "#{Time.at(sess.time_interval.from.tv_sec)} ".ljust(26)
|
62
|
-
print "#{sess.time_interval.to.tv_sec-sess.time_interval.from.tv_sec} ".rjust(8)
|
63
|
-
print "#{sess.key1A.label}".ljust(28)
|
64
|
-
print "#{sess.key2A.label}".ljust(11)
|
65
|
-
print "#{sess.key1Z.label}".ljust(28)
|
66
|
-
print "#{sess.key2Z.label}".ljust(11)
|
67
|
-
print "#{sess.az_bytes}".rjust(10)
|
68
|
-
print "#{sess.za_bytes}".rjust(10)
|
69
|
-
print "#{sess.az_payload}".rjust(10)
|
70
|
-
print "#{sess.za_payload}".rjust(10)
|
71
|
-
print "#{sess.setup_rtt}".rjust(10)
|
72
|
-
print "#{sess.retransmissions}".rjust(10)
|
73
|
-
print "#{sess.tags}".rjust(10)
|
74
|
-
print "\n"
|
75
|
-
|
76
|
-
end
|
77
|
-
|
78
|
-
|
79
|
-
# Print the header column for sess details
|
80
|
-
#
|
81
|
-
# Use this to output session to screen
|
82
|
-
#
|
83
|
-
#
|
84
|
-
# ==== Returns
|
85
|
-
# ==== Yields
|
86
|
-
# Nothing
|
87
|
-
#
|
88
|
-
# Pretty prints a single line session details header w/ correct col widths
|
89
|
-
#
|
90
|
-
# ==== On error
|
91
|
-
def print_session_details_header
|
92
|
-
print "SID".ljust(12)
|
93
|
-
print "Start Time".ljust(26)
|
94
|
-
print "Dur ".rjust(8)
|
95
|
-
print "IP-A".ljust(28)
|
96
|
-
print "Port-A".ljust(11)
|
97
|
-
print "IP-Z".ljust(28)
|
98
|
-
print "Port-Z".ljust(11)
|
99
|
-
print "Fwd Bytes".rjust(10)
|
100
|
-
print "Rev Bytes".rjust(10)
|
101
|
-
print "Fwd Payld".rjust(10)
|
102
|
-
print "Rev Payld".rjust(10)
|
103
|
-
print "RTT".rjust(10)
|
104
|
-
print "Retrans".rjust(10)
|
105
|
-
print "Tags".rjust(10)
|
106
|
-
print "\n"
|
107
|
-
|
108
|
-
print "-"*11 + "+"
|
109
|
-
print "-"*25 + "+"
|
110
|
-
print "-"*7 + "+"
|
111
|
-
print "-"*27 + "+"
|
112
|
-
print "-"*10 + "+"
|
113
|
-
print "-"*27 + "+"
|
114
|
-
print "-"*10 + "+"
|
115
|
-
print "-"*9 + "+"
|
116
|
-
print "-"*9 + "+"
|
117
|
-
print "-"*9 + "+"
|
118
|
-
print "-"*9 + "+"
|
119
|
-
print "-"*9 + "+"
|
120
|
-
print "-"*9 + "+"
|
121
|
-
print "-"*9 + "+"
|
122
|
-
print "\n"
|
123
|
-
end
|
124
|
-
|
125
|
-
|
126
|
-
|
127
|
-
# Make key
|
128
|
-
#
|
129
|
-
# Convert an item into Trisul Key format.
|
130
|
-
#
|
131
|
-
# Example
|
132
|
-
#
|
133
|
-
# == Pass a hostname
|
134
|
-
# mk_trisul_key(conn,GUID_HOSTS,"www.trisul.org") => "D0.D1.01.EA"
|
135
|
-
# mk_trisul_key(conn,GUID_APPS,"https") => "p-01BB"
|
136
|
-
#
|
137
|
-
# == Pass a IP
|
138
|
-
# mk_trisul_key(conn,GUID_HOSTS,"192.168.1.5") => "C0.A8.01.05"
|
139
|
-
# mk_trisul_key(conn,GUID_APPS,"Port-443") => "p-01BB"
|
140
|
-
#
|
141
|
-
#
|
142
|
-
# [conn] active TRP connection opened earlier
|
143
|
-
# [guid] counter group id (eg hosts, apps, countries)
|
144
|
-
# [str] eg a resolved name (eg a host like www.blue.net)
|
145
|
-
#
|
146
|
-
# ==== Returns
|
147
|
-
# A string containing the key in Trisul format corresponding to the
|
148
|
-
# label passed in via ''str''
|
149
|
-
#
|
150
|
-
# ==== Yields
|
151
|
-
# Nothing
|
152
|
-
#
|
153
|
-
# ==== On error
|
154
|
-
def mk_trisul_key(conn,guid,str)
|
155
|
-
req = TrisulRP::Protocol.mk_request(TRP::Message::Command::SEARCH_KEYS_REQUEST,
|
156
|
-
:pattern => str,
|
157
|
-
:counter_group => guid,
|
158
|
-
:maxitems => 1)
|
159
|
-
|
160
|
-
resp = TrisulRP::Protocol.get_response(conn,req)
|
161
|
-
|
162
|
-
if resp.found_keys.size > 0
|
163
|
-
resp.found_keys[0].key
|
164
|
-
else
|
165
|
-
TrisulRP::Keys::make_key(str)
|
166
|
-
end
|
167
|
-
end
|
168
|
-
|
169
|
-
# Print alert details
|
170
|
-
#
|
171
|
-
# [conn] active TRP connection opened earlier
|
172
|
-
# [alerts] an array of AlertIDs
|
173
|
-
#
|
174
|
-
# ==== Returns
|
175
|
-
# ==== Yields
|
176
|
-
# Nothing
|
177
|
-
#
|
178
|
-
# Prints details about the list of alerts passed
|
179
|
-
#
|
180
|
-
# ==== On error
|
181
|
-
def print_alert_details(conn, alerts)
|
182
|
-
|
183
|
-
return if alerts.empty?
|
184
|
-
|
185
|
-
# retrieve details of alerts from server
|
186
|
-
follow_up = TrisulRP::Protocol.mk_request(TRP::Message::Command::ALERT_ITEM_REQUEST,
|
187
|
-
:alert_group => TrisulRP::Guids::AG_IDS,
|
188
|
-
:alert_ids => alerts.collect do |al|
|
189
|
-
TRP::AlertID.new(:slice_id => al.slice_id,
|
190
|
-
:alert_id => al.alert_id)
|
191
|
-
end
|
192
|
-
)
|
193
|
-
|
194
|
-
|
195
|
-
|
196
|
-
TrisulRP::Protocol.get_response(conn,follow_up) do | resp |
|
197
|
-
resolv_candidates = resp.items.collect { |item| [item.source_ip, item.source_port, item.destination_ip, item.destination_port,item.sigid] }
|
198
|
-
resolv_arr = resolv_candidates.transpose
|
199
|
-
sip_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOST, resolv_arr[0])
|
200
|
-
sport_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_APP, resolv_arr[1])
|
201
|
-
dip_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOST, resolv_arr[2])
|
202
|
-
dport_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_APP, resolv_arr[3])
|
203
|
-
sigid_names = TrisulRP::Keys.get_labels_for_keys(conn,TrisulRP::Guids::CG_ALERT_SIGNATURES, resolv_arr[4])
|
204
|
-
resp.items.each do |item|
|
205
|
-
print "#{Time.at(item.time.tv_sec)} "
|
206
|
-
print "#{sip_names[item.source_ip]}".ljust(28)
|
207
|
-
print "#{sport_names[item.source_port]}".ljust(11)
|
208
|
-
print "#{dip_names[item.destination_ip]}".ljust(28)
|
209
|
-
print "#{dport_names[item.destination_port]}".ljust(11)
|
210
|
-
print "#{sigid_names[item.sigid]}".rjust(10)
|
211
|
-
print "\n"
|
212
|
-
end
|
213
|
-
end
|
214
|
-
end
|
215
|
-
end
|